WP6: Authorization Service Workshop in Eger Marcin Adamski, Michał Chmielewski, Sergiusz Fonrobert, Jarek Nabrzyski and Tomasz Ostwald Poznań Supercomputing and Networking Center

March 31st, 2003 Presentation Overview About security in the GridLab Project General Design of Authorization Service Current implementation status Plans for the Eger meeting

March 31st, 2003 Security in GridLAB Security in Grid environments is a significant and still open problem The primary goal of Security Workpackage in the GridLab project is to create flexible and universal Authorization Service The secondary goal is to provide general support to other workpackages in solving detailed technical problems related to security issues

March 31st, 2003 The Authorization Service The main requirement is flexibility of Authorization Service The AS is about to provide universal way of defining security policy for the whole Grid, independent of technologies used at lower levels It should be able to implement most security models for Grids and use many different scenarios at the same time It should support many different security technologies (ex. GSI and Microsoft authentication) It has to be secure and stable implementation (AS is considered as a trusted component of security model)

March 31st, nd phase The General Design 1st phase 3rd phase

March 31st, st phase Current State Core Core AS Component Scenarios Engine Authorization Scenarios Security Policy Database Communication Component Authorization and Security Policy Engine

March 31st, 2003 Current State Security Policy Engine Security Policy Database Authorization Module Security Policy Manager ASP Engine Interface Authorization and Security Policy Engine Security Policy Database Component

March 31st, 2003 AS implementation Implementation in C Compatibility with Globus Toolkit 2.0 Globus Toolkit 2.2 CAS version of GT Service interface using WSDL Source codes will be available in CVS after the Eger Meeting

March 31st, 2003 AS communication Communication: based on GSI protocol, GSI plugin for gSOAP Interface (GSI based protocol) for internal use between AS components, in future may be used to fulfill specific needs of GridLab services Interface functions (WSDL): getServiceDescription getResourcesList getAuthorizationDecision sendCommandLine

March 31st, 2003 AS components as_server storing security policy get authorization decision, generate policy other security info as_client_admin and as_client_admin_soap add security policy items to as_server database as_client and as_client_soap get full policy from sever and generate proxy with this policy as_enabled_tcp_server and client, test_soap_client components for as_server policy tests cas_policy_viewer print policy included into proxy

March 31st, 2003 AS data structure (current)

March 31st, 2003 AS data structure (CAS) Object "cas_object" Subject "User" Object Attribute OBJECT_NAME_TYPE Relation Object Attributes array Subject Attributes array Subject Attributes Id_string Object array "Objects" Subject array "Users" Object Attribute OBJECT_NAME Object Attribute SERVICE_TYPE Object Attribute SERVICE_ACTION Relation array

March 31st, 2003 AS data structure (GRMS) Object "grms_object" Subject "User" Relation Object Attributes array Subject Attributes array Subject Attributes Id_string Object array "Objects" Subject array "Users" Object Attribute OBJECT_NAME Object Attribute OBJECT_URL Relation array

March 31st, 2003 AS data structure Current state (previous slides) arrays of objects, subjects, relations Future tree structure (hierarchical structure) Grid at the top level Services Servers Files Others objects (based upon specific requirements) Currently most of our work is focused on appropriate internal design (gathering requirements is the main goal of Eger meeting)

March 31st, 2003 AS experiment (CAS mode)

March 31st, 2003 Scenario 1 (similar to CAS)

March 31st, 2003 Scenario 2 (Eger) (GRMS only authorization decision) GRID SERVICES as enabled module GRMS grid-mapfile PORTAL AS as decision 6. USER

March 31st, 2003 Scenario 3 (GRMS proxy file) GRID SERVICES as enabled module USER GRMS grid-mapfile PORTAL AS as decision as proxy GRMS proxy certificate (logical part of policy included) user proxy certificate user certificate CA certificate

March 31st, 2003 The Nearest Future Experiment aimed at integration of portal with resource manager Complete design and implementation of AS internals (fulfilling most of possible grid specific requirements) Designing and implementing the initial set of scenarios to be used in the GridLab project Introduce database support for storing security policy Verify security level and quality of implementation

March 31st, 2003 Plans for Eger Meeting Gather information about detailed authorization requirements of various services Prepare for experiment aimed at integration of portal with resource manager Planned meetings: Portals (WP4) Monitoring (WP11) Testbed (WP5) Resource Management (WP9+WP4+WP6) Mobile (WP4+WP12+WP6) Others